Automatic prevention of buffer overflow vulnerability using candidate code generation

Young Su Jang, Jin Young Choi

Research output: Contribution to journalArticlepeer-review

6 Citations (Scopus)


The security of a software program critically depends on the prevention of vulnerabilities in the source code; however, conventional computer programs lack the ability to identify vulnerable code in another program. Our research was aimed at developing a technique capable of generating substitution code for the detection of buffer overflow vulnerability in C/C++ programs. The technique automatically verifies and sanitizes code instrumentation by comparing the result of each candidate variable with that expected from the input data. Our results showed that statements containing buffer overflow vulnerabilities could be detected and prevented by using a substitution variable and by sanitizing code vulnerabilities based on the size of the variables. Thus, faults can be detected prior to execution of the statement, preventing malicious access. Our approach is particularly useful for enhancing software security monitoring, and for designing retrofitting techniques in applications.

Original languageEnglish
Pages (from-to)3005-3018
Number of pages14
JournalIEICE Transactions on Information and Systems
Issue number12
Publication statusPublished - 2018 Dec

Bibliographical note

Funding Information:
This research was supported by the MSIT (Ministry of Science and ICT), Korea, under the ITRC (Information Technology Research Center) support program (2015-0-00445) supervised by the IITP (Institute for Information & communications Technology Promotion) and Institute for Information & communications Technology Promotion (IITP) grant funded by the Korea government (MSIT) (No. 2018-0-00532, Development of High-Assurance (≥ EAL6) Secure Microkernel).

Publisher Copyright:
Copyright © 2018 The Institute of Electronics, Information and Communication Engineers


  • Buffer overflow vulnerability
  • Information security
  • Software security monitoring

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Vision and Pattern Recognition
  • Electrical and Electronic Engineering
  • Artificial Intelligence


Dive into the research topics of 'Automatic prevention of buffer overflow vulnerability using candidate code generation'. Together they form a unique fingerprint.

Cite this